Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/09/2022, 09:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    682ee9d6604ddbc0b6dfdaa7c267624ab7b8a269aa26b50af08bfc69ba9523cc.exe

  • Size

    196KB

  • MD5

    19770b03d1c191ccd5a67cc90894376a

  • SHA1

    2c96d543ad29665a440fde4b0d11aa1da0787db2

  • SHA256

    682ee9d6604ddbc0b6dfdaa7c267624ab7b8a269aa26b50af08bfc69ba9523cc

  • SHA512

    e2f0a84dd198a7eb6087640a080b1be77bada2c35c84c04f2f6a95f27814431eac63847d436b81e91fb20bb8ef95ecccd08637cdf564da707d786bd22788076a

  • SSDEEP

    3072:cmR1L/O3DVH85ldAY2d53utSqpElXZ5BrXjG/PkF4x:3LiDVSdyd53utS2qZ/X

Score
10/10
danabotsmokeloaderbackdoorbankertrojan

Malware Config

Extracted

Family

danabot

C2

198.15.112.179:443

185.62.56.245:443

153.92.223.225:443

192.119.70.159:443

49.0.50.0:57

51.0.52.0:0

53.0.54.0:1200

55.0.56.0:65535
Attributes
  • embedded_hash

    6618C163D57D6441FCCA65D86C4D380D

  • type

    loader

Signatures

  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot
  • Detects Smokeloader packer 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 39 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 50 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 19 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\682ee9d6604ddbc0b6dfdaa7c267624ab7b8a269aa26b50af08bfc69ba9523cc.exe
    "C:\Users\Admin\AppData\Local\Temp\682ee9d6604ddbc0b6dfdaa7c267624ab7b8a269aa26b50af08bfc69ba9523cc.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4196
  • C:\Users\Admin\AppData\Local\Temp\4035.exe
    C:\Users\Admin\AppData\Local\Temp\4035.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:3912
    • C:\Windows\SysWOW64\agentactivationruntimestarter.exe
      C:\Windows\system32\agentactivationruntimestarter.exe
      2⤵
        PID:3872
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
        2⤵
        • Blocklisted process makes network request
        PID:4148
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 252
        2⤵
        • Program crash
        PID:4688
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 872
        2⤵
        • Program crash
        PID:4072
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 924
        2⤵
        • Program crash
        PID:2220
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
        2⤵
        • Blocklisted process makes network request
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        PID:3624
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 1012
        2⤵
        • Program crash
        PID:4880
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2560
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x500 0x4e4
      1⤵
        PID:5108
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3912 -ip 3912
        1⤵
          PID:3788
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3912 -ip 3912
          1⤵
            PID:1728
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3912 -ip 3912
            1⤵
              PID:1800
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3912 -ip 3912
              1⤵
                PID:5068

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\4035.exe
                Filesize

                1.3MB

                MD5

                7a14f2a7902fd7f1199cf3adb6bc77e5

                SHA1

                2036574d84573d0399b2968dc32e5b52437ecdd5

                SHA256

                3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc

                SHA512

                c64b643ec38978c9ce4d810689b4eb9569d1f948c78434a0e469e4d9e597cb50c89f0d3b3b8bbe7e17735f9f40f2ed29ea88ea9958c5da33c7751e3502101324

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\4035.exe
                Filesize

                1.3MB

                MD5

                7a14f2a7902fd7f1199cf3adb6bc77e5

                SHA1

                2036574d84573d0399b2968dc32e5b52437ecdd5

                SHA256

                3bdd87bfb09ed50bb6fb743d23c052aae947c420b5f64916216cd0c2d90109fc

                SHA512

                c64b643ec38978c9ce4d810689b4eb9569d1f948c78434a0e469e4d9e597cb50c89f0d3b3b8bbe7e17735f9f40f2ed29ea88ea9958c5da33c7751e3502101324

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Fiuepr.tmp
                Filesize

                3.3MB

                MD5

                be03bd71d3ba639632b50cb9a3931d56

                SHA1

                bcf03bb5c228044abd984485b0e10fc4e16c0c6c

                SHA256

                1e50f193c8e645a6c93feb42b1ffd46dec68738106dec79014815ac444612234

                SHA512

                fc0eada90ff1b4c5c805fd38c1bfade389f8b1d58c45611fdaa6a0c303a56cf4d78a49dabb1de0b9eb7458d952b65589256a82262a84c5914b6b7f974336bc8d

                Download Submit

              • memory/3624-166-0x00000000027F0000-0x00000000032AE000-memory.dmp

                Filesize

                10.7MB

                Download

              • memory/3624-165-0x00000000027F0000-0x00000000032AE000-memory.dmp

                Filesize

                10.7MB

                Download

              • memory/3624-164-0x0000000000400000-0x0000000000D9E000-memory.dmp

                Filesize

                9.6MB

                Download

              • memory/3624-163-0x0000000003490000-0x00000000035D0000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3624-162-0x0000000003490000-0x00000000035D0000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3624-161-0x00000000027F0000-0x00000000032AE000-memory.dmp

                Filesize

                10.7MB

                Download

              • memory/3912-141-0x00000000024A0000-0x000000000277B000-memory.dmp

                Filesize

                2.9MB

                Download

              • memory/3912-156-0x0000000003C10000-0x0000000003D50000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3912-145-0x0000000000400000-0x00000000006E8000-memory.dmp

                Filesize

                2.9MB

                Download

              • memory/3912-167-0x0000000002FC0000-0x0000000003A7E000-memory.dmp

                Filesize

                10.7MB

                Download

              • memory/3912-143-0x0000000000400000-0x00000000006E8000-memory.dmp

                Filesize

                2.9MB

                Download

              • memory/3912-148-0x0000000002FC0000-0x0000000003A7E000-memory.dmp

                Filesize

                10.7MB

                Download

              • memory/3912-149-0x0000000000400000-0x00000000006E8000-memory.dmp

                Filesize

                2.9MB

                Download

              • memory/3912-150-0x0000000002FC0000-0x0000000003A7E000-memory.dmp

                Filesize

                10.7MB

                Download

              • memory/3912-151-0x0000000002FC0000-0x0000000003A7E000-memory.dmp

                Filesize

                10.7MB

                Download

              • memory/3912-152-0x0000000003C10000-0x0000000003D50000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3912-153-0x0000000003C10000-0x0000000003D50000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3912-154-0x0000000003C10000-0x0000000003D50000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3912-155-0x0000000003C10000-0x0000000003D50000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3912-144-0x0000000000400000-0x00000000006E8000-memory.dmp

                Filesize

                2.9MB

                Download

              • memory/3912-157-0x0000000003C10000-0x0000000003D50000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3912-158-0x0000000003C10000-0x0000000003D50000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3912-142-0x0000000000400000-0x00000000006E8000-memory.dmp

                Filesize

                2.9MB

                Download

              • memory/3912-159-0x0000000003C10000-0x0000000003D50000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3912-140-0x0000000002375000-0x000000000249B000-memory.dmp

                Filesize

                1.1MB

                Download

              • memory/4196-132-0x0000000000708000-0x0000000000718000-memory.dmp

                Filesize

                64KB

                Download

              • memory/4196-135-0x0000000000400000-0x000000000058B000-memory.dmp

                Filesize

                1.5MB

                Download

              • memory/4196-134-0x0000000000400000-0x000000000058B000-memory.dmp

                Filesize

                1.5MB

                Download

              • memory/4196-133-0x00000000006E0000-0x00000000006E9000-memory.dmp

                Filesize

                36KB

                Download